Initial support for HSTS certificate locking. This isn't a finished work, but

net/base/transport_security_state.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/base/transport_security_state.h"
 
+#include <set>
+
 #include "base/base64.h"
 #include "base/json/json_reader.h"
 #include "base/json/json_writer.h"
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/sha2.h"
 #include "base/string_number_conversions.h"
 #include "base/string_tokenizer.h"
 #include "base/string_util.h"
 #include "base/utf_string_conversions.h"
 #include "base/values.h"
 #include "googleurl/src/gurl.h"
 #include "net/base/dns_util.h"
+#include "net/base/x509_cert_types.h"
+#include "net/base/x509_certificate.h"
 
 namespace net {
 
 const long int TransportSecurityState::kMaxHSTSAgeSecs = 86400 * 365;  // 1 year
 
 TransportSecurityState::TransportSecurityState()
     : delegate_(NULL) {
 }
 
 void TransportSecurityState::EnableHost(const std::string& host,
                                         const DomainState& state) {
   const std::string canonicalized_host = CanonicalizeHost(host);
   if (canonicalized_host.empty())
     return;
 
+  // TODO(cevans) -- we likely want to permit a host to override a built-in,
+  // for at least the case where the override is stricter (i.e. includes
+  // subdomains, or includes cert locks).
   bool temp;
   if (IsPreloadedSTS(canonicalized_host, &temp))
     return;
 
   char hashed[base::SHA256_LENGTH];
   base::SHA256HashString(canonicalized_host, hashed, sizeof(hashed));
 
   // Use the original creation date if we already have this host.
   DomainState state_copy(state);
   DomainState existing_state;
@@ skipping 76 matching lines @@
     // include_subdomains is.
     if (i == 0)
       return true;
 
     return j->second.include_subdomains;
   }
 
   return false;
 }
 
+bool TransportSecurityState::IsAcceptableCertificate(const std::string& host,
+                                                     X509Certificate* cert) {
+  DomainState state;
+  if (!IsEnabledForHost(&state, host))
+    return true;
+
+  if (state.cert_locks.empty())
+    return true;
+
+  std::set<std::string> fingerprints;
+  X509Certificate::OSCertHandles cert_chain;
+  X509Certificate::GetCertChainFromCert(cert->os_cert_handle(), &cert_chain);
+  {
+    X509Certificate::OSCertHandles::const_iterator i;
+    for (i = cert_chain.begin(); i != cert_chain.end(); ++i) {
+      net::SHA1Fingerprint fingerprint =
+          X509Certificate::CalculateFingerprint(*i);
+      std::string hash;
+      for (size_t i = 0; i < sizeof(fingerprint.data); ++i)
+        hash += StringPrintf("%02X", fingerprint.data[i]);

[abarth-chromium, 2011/04/04 22:49:36]

This code looks pretty low-level.  Why can't SHA1Fingerprint do this work for
us?

+      fingerprints.insert(hash);
+    }
+  }
+  X509Certificate::DestroyCertChain(&cert_chain);
+  std::vector<std::string>::const_iterator locks_iter;
+  for (locks_iter = state.cert_locks.begin();
+       locks_iter != state.cert_locks.end(); ++locks_iter) {
+    std::string cert_lock = *locks_iter;
+    if (fingerprints.find(cert_lock) != fingerprints.end())
+      return true;
+  }
+  return false;
+}
+
 void TransportSecurityState::DeleteSince(const base::Time& time) {
   bool dirtied = false;
 
   std::map<std::string, DomainState>::iterator i = enabled_hosts_.begin();
   while (i != enabled_hosts_.end()) {
     if (i->second.created >= time) {
       dirtied = true;
       enabled_hosts_.erase(i++);
     } else {
       i++;
@@ skipping 164 matching lines @@
         break;
       case DomainState::MODE_SPDY_ONLY:
         state->SetString("mode", "spdy-only");
         break;
       default:
         NOTREACHED() << "DomainState with unknown mode";
         delete state;
         continue;
     }
 
+    ListValue* locks = new ListValue;
+    std::vector<std::string>::const_iterator lock_strings;
+    for (lock_strings = i->second.cert_locks.begin();
+         lock_strings != i->second.cert_locks.end();
+         ++lock_strings)
+      locks->Append(new StringValue(*lock_strings));
+    state->Set("cert_locks", locks);

[abarth-chromium, 2011/04/04 22:49:36]

Again, pin is probably a better term.

+
     toplevel.Set(HashedDomainToExternalString(i->first), state);
   }
 
   base::JSONWriter::Write(&toplevel, true /* pretty print */, output);
   return true;
 }
 
 bool TransportSecurityState::Deserialise(const std::string& input,
                                          bool* dirty) {
   enabled_hosts_.clear();
@@ skipping 17 matching lines @@
     std::string mode_string;
     double created;
     double expiry;
 
     if (!state->GetBoolean("include_subdomains", &include_subdomains) ||
         !state->GetString("mode", &mode_string) ||
         !state->GetDouble("expiry", &expiry)) {
       continue;
     }
 
+    ListValue* locks_list;
+    std::vector<std::string> cert_locks;
+    if (state->GetList("cert_locks", &locks_list)) {
+      size_t num_locks = locks_list->GetSize();
+      for (size_t i = 0; i < num_locks; ++i) {
+        std::string lock_string;
+        if (locks_list->GetString(i, &lock_string))
+          cert_locks.push_back(lock_string);
+      }
+    }
+
     DomainState::Mode mode;
     if (mode_string == "strict") {
       mode = DomainState::MODE_STRICT;
     } else if (mode_string == "opportunistic") {
       mode = DomainState::MODE_OPPORTUNISTIC;
     } else if (mode_string == "spdy-only") {
       mode = DomainState::MODE_SPDY_ONLY;
     } else {
       LOG(WARNING) << "Unknown TransportSecurityState mode string found: "
                    << mode_string;
@@ skipping 11 matching lines @@
       created_time = base::Time::Now();
     }
 
     if (expiry_time <= current_time) {
       // Make sure we dirty the state if we drop an entry.
       dirtied = true;
       continue;
     }
 
     std::string hashed = ExternalStringToHashedDomain(*i);
-    if (hashed.empty())
+    if (hashed.empty()) {
+      dirtied = true;
       continue;
+    }
 
     DomainState new_state;
     new_state.mode = mode;
     new_state.created = created_time;
     new_state.expiry = expiry_time;
     new_state.include_subdomains = include_subdomains;
+    new_state.cert_locks = cert_locks;
     enabled_hosts_[hashed] = new_state;
   }
 
   *dirty = dirtied;
   return true;
 }
 
 TransportSecurityState::~TransportSecurityState() {
 }
 
@@ skipping 92 matching lines @@
         *include_subdomains = kPreloadedSTS[j].include_subdomains;
         return true;
       }
     }
   }
 
   return false;
 }
 
 }  // namespace